Client-8.5-9.2.docx PDF

Sharing files and folders on a local area network is often necessary in an organization. You can implement this in a controlled way using share permissions and NTFS permissions. This lesson covers the following topics: - Share permissions - NTFS permissions - Permission facts - Permissi...

Sharing files and folders on a local area network is often necessary in an organization. You can implement this in a controlled way using share permissions and NTFS permissions. This lesson covers the following topics: - Share permissions - NTFS permissions - Permission facts - Permission management **Share Permissions** In Windows, share permissions allow access to files and folders shared and accessed over a network. Share permissions offer three options to limit what a user can do with the shared file or folder. The following table displays the three permission options and the allowed actions for each option. Full control actions are: - Ownership - Read - Write - Create - Delete - Change permissions Change actions are: - Read - Write - Create - Delete Read actions are: - Read - Copy - Run Be aware of the following when sharing files: - You must explicitly enable file sharing before network users can access shared folders. When you share a folder for the first time, you are prompted whether you want to enable file sharing. - To switch between simple and advanced sharing, select **Advanced Sharing**. - You can use the following tools to manually share a folder: - Shared Folder snap-in in Computer Management. - Properties for the folder in File Explorer. - Network and Sharing Center to enable public folder sharing or media sharing. - When you share a folder, you give it a name. The share name is not the same as the folder name, although they can be the same. - To access a shared folder on the network, you can use: - The UNC path to the shared folder with the following syntax: \\\\computername\\sharename. - The Network feature to browse the network for the computer and view any shared folders on that computer. - The **net use** command to map a drive letter to the shared folder. - **net use** lists the current connected shared folders and drive letters. - **net use *drive: folder path*** maps the drive letter to the specific shared folder. For example, net use F: \\\\Wrk1\\shared2. - **net use *\* folder path*** maps the next available drive letter to the shared folder. - **/persistent:yes** reconnects the connection at each subsequent logon; **/persistent:no** makes the mapping temporary. - **net use /?** lists the valid parameters for the net use command. You can also enter **net use ?** . - To create an administrative share, add a dollar sign (\$) to the end of a share name. - Administrative shares are not visible when browsing the network. You must use the UNC path to connect to an administrative share. - By default, Windows automatically creates an administrative share for every volume. The share name is the volume letter plus the dollar sign (such as C\$). - Only a member of the Administrators group can access default administrative shares. - You can configure share permissions to control access to administrative shares you create yourself. - A computer must be powered on (and be awake) before users can access the shared folder. - Network acts as a built-in network browser showing all networks and shared folders the user has access to. You can view the same information in This PC and File Explorer. **NTFS Permissions** NTFS permissions differ from share permissions in several significant ways. NTFS permissions: - Apply to files accessed over the network or locally. - Offer granular control over folders and files. - Can be assigned to system users. NTFS permissions for folders include the following six options and their allowed actions. Full control actions are: - Ownership - Create new files and subfolders - List - Delete - Change permissions Modify actions are: - Create new files and subfolders - List - Delete Read and execute actions are: - Read files - Execute any executable files List folder contents allows a user to view the folder\'s contents. Read allows a user to view the content within the files in the folder. Write actions are: - Create new files and subfolders - Modify any existing files The five NTFS permissions options for the file level share the same names as the folder permissions and are very similar, but the way they work is a little different. Full control actions are: - Ownership - Read - Write - Execute - Delete - Change permissions Modify actions are: - Read - Write - Execute - Delete Read and execute actions are: - Read - Execute any executable files Read allows a user to view the content within the files in the folder. Write actions are: - Create new files - Write - Edit **Permission Facts** There are important things to understand when working with permissions. - NTFS permissions are cumulative. - You can assign one or more permission to a file or folder for a user account. - The combination of all assigned permissions determine user access. - You can use NTFS permissions and share permissions simultaneously. - Share permissions apply only when the file or folder is accessed over the network. - Share permissions override NTFS permissions when the file or folder is accessed over the network. For example, the user has been assigned the Write permission in NTFS and the Read permission in share permissions. - The user is denied the ability to modify the file when accessing it over the network. - The user can modify the file when accessing it locally. - A Deny permission setting always overrides an Allow permission. For example, if a user belongs to two groups, and a specific permission is allowed for one group and denied for the other, the permission is denied. - By default, parent folders inherit NTFS permissions. - Copying or moving files with NTFS permissions can affect the permissions on the file or folder. - You must have the proper permissions to copy or move a folder or a file. - To copy a file or folder, you must have the Read permission to the source file and the Write permission to the destination location. - To move a file or folder, you must have Read and Modify permissions to the source file, and the Write permission to the destination location. - Copying or moving a file to a non-NTFS partition, removes all permissions. - In all cases, if you copy or move a file to an NTFS partition, it inherits the permissions assigned to the parent partition and folders. - When you assign explicit NTFS permissions to a file: - Copying or moving the file to a different NTFS partition, removes the explicit permissions. - Moving the file to a different folder on the same NTFS partition, retains the explicit permissions. - Copying the file to a different folder on the same NTFS partition, removes the explicit permissions. - In all cases, the file also inherits permissions from its new partition and folder. **Permission Management** It may feel overwhelming to manage permissions to make sure that users have the access they need to do their work, but also do not have unnecessary access. The following techniques are best practices for managing permissions. - Always apply the principle of least privilege. This means you limit the user\'s access to only what is necessary for that user to be able to do the job or tasks. - Use groups to manage permissions. - Create a group for each role in the organization and assign the proper permissions for that role to that group. - Assign the appropriate users to the group. If the user\'s role changes, remove the user from the group and assign the user to the appropriate group. If you assign users to more than one group, the user has the least restrictive access of the two groups as permissions are cumulative. - When implementing share permissions with NTFS permissions, set the share permissions to Full Control and then use the NTFS permissions to fine tune the level of access to files and folders. This strategy is helpful because it: - Eliminates conflicting permission assignments. - Applies the most restrictive permissions both locally and over the network. This lesson covers the following topics: - Basic Input/Output System (BIOS) boot - Unified Extensible Firmware Interface (UEFI) boot **Basic Input/Output System (BIOS) Boot** Windows systems can boot using either a legacy BIOS or a UEFI boot sequence. Understanding these boot sequences enables you to focus troubleshooting efforts on the most likely errors. Power On Self-Test (POST): The following steps take place on a system using BIOS: 1. Power is supplied to the CPU. The CPU is hard-coded to look at a particular memory address containing a printer (or jump program) that instructs the CPU where to find the BIOS program. 2. The CPU loads the BIOS program. The first BIOS process to run is the POST, which verifies the integrity of the BIOS code. POST also: - Locates, sizes, and verifies system memory. - Verifies and initializes video card (output displays on the monitor). - Identifies available hard disks. 3. After POST tests are complete, the BIOS: - Identifies other system devices. - Uses CMOS settings and information supplied by the devices to identify and configure hardware devices. - Allocates system resources to plug-and-play devices. - Typically displays information about the keyboard, mouse, and SATA drives. - Displays information about devices and system resources. 4. The BIOS then searches for a boot drive using the boot order specified in the CMOS. During this sequence, system information displays on the screen, and the option to enter the CMOS setup to configure system parameters is available. Boot Loader: The following process occurs during the Boot Loader stage: 1. On the boot device, the BIOS searches for and loads the boot code into the Master Boot Record (MBR). The MBR is located in the first sector on the disk. 2. The MBR boot code uses the partition table to identify the active disk partition. 3. On the active partition, MBR boot code looks for and loads the bootmgr.exe program. 4. The bootmgr.exe program looks for the binary-coded decimal (BCD) store in either the C:\\ directory or the System Reserved partition. The BCD store contains a list of all Windows installations on the disk. 5. If only one installation exists, bootmgr.exe automatically loads the operating system (OS). If multiple installations exist, it displays a list of bootable operating systems. This stage occurs after the BIOS information screen disappears but before the Windows loading screen displays. OS Startup: The operating system starts up during the OS Startup stage. The OS configures system devices and loads necessary files. The following process occurs: 1. The operating system loader, winload.exe, starts. At this stage, you can access advanced startup options (e.g., Safe Mode) by pressing the **F8** key (on most computers). winload.exe loads the following: - System Registry - Ntoskrnl.exe - Essential device drivers 2. Control of the system passes to ntoskrnl.exe. 3. At this point, the Windows logo displays and ntoskrnl.exe: - Loads device drivers. - Starts services. - Configures the OS environment. Logon and User Configuration: The operating system starts up during the OS Startup stage. The OS configures system devices and loads necessary files. The following process occurs: 1. The operating system loader, winload.exe, starts. At this stage, you can access advanced startup options (e.g., Safe Mode) by pressing the **F8** key (on most computers). winload.exe loads the following: - System Registry - Ntoskrnl.exe - Essential device drivers 2. Control of the system passes to ntoskrnl.exe. 3. At this point, the Windows logo displays and ntoskrnl.exe: - Loads device drivers. - Starts services. - Configures the OS environment. **Unified Extensible Firmware Interface (UEFI) Boot** UEFI is a newer boot specification that defines the software interface between an operating system and the computer\'s firmware. Security (SEC): The SEC sequence begins immediately after the system is powered on. The steps are listed below. 1. Power is supplied to the CPU. 2. The CPU switches from 16-bit Real Mode to 64-bit Protected Mode. 3. The CPU executes a specific set of instructions to prepare the system for the Pre-EFI Initialization (PEI). Pre-EFI Initialization: PEI initializes the system and prepares for the Driver Execution Environment (DXE). The steps are listed below. 1. The CPU and chipset are verified and fully initialized. 2. System memory is initialized, verified, and allocated. 3. PEI modules are loaded to allocate system resources. 4. The DXE is initialized, and the system is prepared to transition to DXE. Driver Execution Environment (DXE): DXE initializes configured devices, mounts drives, and prepares to boot the OS. The steps are listed below. 1. Device drivers load into memory. 2. Hardware devices (e.g., video card, network card, USB controllers) initialize simultaneously. 3. System drives mount and initialize. 4. The EFI boot manager initializes. Boot Device Selection (BDS): The BDS stage runs the EFI boot manager, which identifies the system\'s boot configuration settings and decides how to boot the system. - If an EFI System Partition (ESP) exists, the following process occurs: 1. On the ESP in the \\EFI\\Microsoft directory, the boot manager looks for and runs the bootmgfw.efi file. 2. The bootmgfw.efi looks for the BCD store in the same directory that contains a list of all Windows installations. 3. If only one installation exists, UEFI automatically loads it. If multiple installations exist, a list of bootable operating systems displays. - If no ESP exists, the boot manager uses legacy BIOS mode to complete the boot sequence: 4. The MBR looks for and loads the bootmgr.exe program. 5. The bootmgr.exe program looks for the BCD store in either the C:\\ directory or the System Reserved partition. 6. If only one installation exists, bootmgr.exe automatically loads the OS. If multiple installations exist, a list of bootable operating systems displays. At the beginning of the BDS stage, the UEFI interface executes. The option to load the EFI Shell or enter the UEFI configuration is available. Transient System Loader (TSL): During TSL stage, the operating system loader is located and booted. The steps are listed below. 1. The BCD store identifies the location of the operating system loader (for Windows, the default location is C:\\Windows\\system32\\winload.efi). 2. The operating system loader winload.efi is started. 3. Winload.efi then loads the following elements: - System Registry. - Ntoskrnl.exe. - Essential device drivers. Run Time (RT): After the operating system and devices are configured, the system waits for user logon. Following logon, the operating system is configured with user-specific settings. The steps are listed below. 1. Control of the system passes to ntoskrnl.exe. 2. The Windows logo displays and ntoskrnl.exe: - Loads device drivers. - Starts services. - Configures the OS environment. 3. The wininit and winlogon programs run to allow user logon. The Welcome screen displays. 4. Following logon, all remaining device drivers and user settings load. In addition, the current configuration profile copies to the Last Known Good Configuration Registry. Even though it has more stages, the UEFI boot sequence is considerably faster than the BIOS boot sequence. **Startup Error Facts** System does not power on: If the system does not power on: - Ensure the system is plugged in and the power strip or UPS is turned on. - Check the power switch and the power type (110 or 220 volts) on the back of the power supply. - Make sure the battery is installed (if the computer is a notebook or tablet). Ensure that the AC adapter is plugged in. - Make sure the system case power switch connects to the motherboard (if you have just installed a new system). When you turn on the computer, you should hear the power supply fan and the CPU fan start to spin. System powers on, but no display is visible: If the system powers on but there is nothing on the display, check the following: - Ensure the monitor is connected to the computer, plugged in, and turned on. - Verify that the BIOS/UEFI is configured to use the correct video adapter. You can configure most motherboards to use either the integrated video adapter or a PCIe video adapter installed in an expansion slot. - Verify that the CPU, memory, and video card are correctly installed. To display startup information on the screen, the computer needs these three components. Other components are not necessary. - If necessary, reduce the system to the three components listed above and try starting the system. - If that does not work, swap out components to identify the failed component. Some computers use a series of beeps to indicate specific problems when messages cannot be shown on the screen. In this case, consult the motherboard documentation for the meaning of the audible messages. Corrupt MBR or partition table: The master boot record (MBR) is responsible for locating the system (active) partition and loading the volume boot record (VBR). A corrupt or missing master boot record or a corrupt partition table prevents the system from loading the boot record code, finding the volume boot record, and loading the boot loader program.\ \ Symptoms of a corrupt MBR or partition table include: - The system hangs immediately after the BIOS information displays. - Any of the following errors: - MBR corrupt - Invalid partition table - Error loading operating system - Missing operating system To fix the problem, boot the system from the installation disc and repair the system.\ \ MBR can also be repaired with Command Prompt. First, boot from the original installation media. Next, select **Repair your computer** from the installation screen. Next, select **Troubleshoot** \> **Advanced** **options** \> **Command Prompt** . Then, enter the following commands one at a time and press enter after each command: - **bootrec /fixmbr** - **bootrec /fixboot** - **bootrec /scanos** - **bootrec /rebuildbcd** When it completes the process, enter **exit** and restart the computer. Corrupt boot sector: The boot sector (also called the volume boot record or volume boot code) is responsible for loading the operating system boot loader program (BOOTMGR).\ \ At this point in the process, the MBR has loaded and located an active partition, but there is a problem in loading the VBR: either the VBR does not specify a boot loader program, or the boot loader specified in the VBR is missing, or corrupt. Symptoms of a corrupt or missing boot sector include: - System hangs following the BIOS information screen. - Any of the following errors: - Non-system disk or disk error - Remove disks or other media - Invalid system disk - Invalid media type - Disk boot failure - A disk read error occurred - BOOTMGR is missing - Missing GRUB/LILO To correct the problem, you can check the boot order in the BIOS/UEFI to make sure the system is booting from the correct storage device. Then, boot from the installation disk and repair the system. If the device is a removable media device, the drive should be empty (so the drive is skipped when checking for a boot disk), or the drive must have media that includes a bootable partition for the system to boot from that drive. A common cause of the non-system disk error is leaving a USB device plugged in. You can avoid these errors by disabling the USB Device option in the boot sequence or setting the integrated USB controller to No Boot. Inaccessible boot disk: The boot loader program uses the boot configuration database (BCD) to locate valid Windows installations to start. If the database points to a location that does not include operating system files, you will see a message similar to the following: *Windows could not start because of a computer disk hardware configuration problem. Could not read from the selected boot disk. Check boot path and disk hardware.* To correct the problem, boot the system from the installation disc and repair the system. The issue may also be resolved by updating device drivers, as they can cause compatibility issues when out-of-date. Missing or corrupt file: If the Boot Manager cannot locate needed operating system files on the selected boot partition, you might see the following errors occur: - Windows could not start because the following file is missing or corrupt: \ Please re-install a copy of the above file. - A blue screen error that describes a corrupt or missing file. This problem is caused by a corrupt disk, corrupt files, or missing files. To correct the problem, boot the system from the installation disc and repair the system. Blue/Black screen or system hangs after Windows splash screen is displayed: The most common cause of the errors is bad drivers or corrupt registry settings. To correct the problem, try the following (in this order): - If the error includes any error codes or messages, check the Microsoft website for troubleshooting information. - If you can, boot the system into Safe Mode. In Safe Mode, roll back drivers, remove drivers, or restore to a restore point. - To identify the driver causing the problem, enable boot logging, then read the Ntbtlog.txt file to identify the last driver the system tried to load. - If you cannot boot into Safe Mode, boot into the Recovery Environment and use System Restore to restore to a restore point created when the system was working correctly. Service fails to start: If a service fails to start, you will see a message such as: *At least one service or driver failed during system startup. Use Event Viewer to examine the event log for details.* Use Event Viewer to view details about the service that did not start. Then try starting the service manually. If necessary, re-enable or re-install the service. Corrupt or missing DLL or system file: If you see corrupt or missing DLL or system file errors (either during startup or after Windows starts), boot the system from the installation disc and repair the system. Device fails to start:\ This message indicates that a hardware device could not be started. Begin by checking Device Manager for information about the device. If necessary, update the driver or disable the device. System recovery procedures are necessary when you are unable to boot a computer or when other problems prevent it from working properly. This lesson covers the following topics: - System recovery procedures - Selecting a system recovery procedure **System Recovery Procedures** Before using recovery tools, try other methods to resolve the problem, including: - Remove problematic hardware or software. - Update drivers, applications, and operating system files. - Boot into safe mode to disable devices or roll back unstable drivers. If these steps do not resolve the problem, you can use the following tools to recover the system: Recovery Environment Advanced Options: The Windows Recovery Environment (WinRE) is a set of tools used to recover the operating system. The following tools are included in the Recovery Environment Advanced Options for Windows: - **Reset this PC** lets you choose to keep or remove your personal files and then reinstall Windows. - **Startup Repair** automatically fixes problems that prevent Windows from loading. - **Startup Settings** changes Windows startup behavior. - **Command Prompt** opens a Command Prompt window with administrator privileges. You can then run command line utilities that provide full access to the file system and volumes. - **Uninstall Updates** allows a user to remove quality or feature updates. - **UEFI Firmware Settings** is an additional option if the system has a Unified Extensible Firmware Interface. - **System Image Recovery** implements a system image restore using a system image file. Choose this option if the hard disk fails or a clean re-install is needed. - **System Restore** starts a system restore to a previous restore point. Use this option if system changes are causing problems. When in the Windows Recovery Environment, the options listed above can be accessed by selecting **Troubleshoot** \> **Advanced options**. Access the Recovery Environment in a Windows client by performing one of the following: - Boot from a Windows installation media and choose **Repair Your Computer**. - Boot the computer to the advanced boot menu (by pressing F8) and choose **Repair Your Computer**. - Boot the computer from a system repair disc. A system repair disc allows you to boot the system and access the recovery environment. To create a system repair disc, use the Create a system repair disk utility. - Windows will automatically start in WinRE if it detects any of the following: - Two consecutive unintended shut downs within 2 minutes of booting the system. - A Secure Boot error. - A BitLocker error on touch-only drives. - If Windows is bootable, you can choose one of the following: - Launch the Settings app and select **System** \> **Recovery** \> **Advanced Startup** \> **Restart Now**. - Bring up an elevated command prompt on the system and run **shutdown /o /r**. - If Windows is not bootable, you can enter the Recovery Environment by booting the system from: - The Windows install media (select **Repair Your Computer** ). - A recovery drive. - A system repair disc. A *recovery drive* is a USB flash drive that contains the Windows recovery environment. You can use it to access the Recovery Environment options, such as running a system restore or recovering a system image.\ \ Use Cortana to search for recovery and select **Create a recovery drive**. Choose **Copy contents from the recovery partition to the recovery drive** to include the contents of a recovery partition on the recovery drive. The process of creating the drive will erase all of the data on the drive. System Restore: You can use a restore point to revert the system to a previous point in time when it was working properly. When using a restore point: - System changes made since the restore point was taken are undone. Any applications, device drivers, or patches installed since the restore point was taken will be removed when the system is reverted to that restore point. - User data is not affected. Any files that have been changed since the restore point was taken remain unchanged when the system is reverted to that restore point. If the system can boot into Windows: 1. Right-click **Start** and select **Settings**. 2. From the right, scroll down and select **About**. 3. In *Related links* , select **System protection**. 4. Under *System Restore* , select **System Restore**. System Image Recovery: If you are unable to repair a system using a restore point, automatic repair, or from the Command Prompt, you can restore the system from a system image backup. Be aware of the following facts regarding system image recovery: - The restore process reformats hard drives, destroying all existing data. - The restore process restores all the volumes you selected during the system image backup, including all user data on those volumes. Therefore, any changes made since the last time the system image was created will be lost. - You cannot restore individual files from a system image backup. - You can use the following options to restore from a system image backup: - If the system is bootable, open Control Panel and select **System and Security** \> **Backup and Restore (Windows 7** ). - If the system is not bootable, boot the system from the Windows installation media or WinRE and repair the installation. Select **Troubleshoot** \> **Advanced Options** \> **See more recovery options** \> **System Image Recovery**. Startup repair: If Windows will not boot, you can use the Startup Repair option to fix problems automatically. Boot the system from the Windows installation disc or WinRE and repair the installation. Select **Troubleshoot** \> **Advanced Options** \> **Startup Repair**. The repair process does the following: - Inspects and repairs the boot sector. - Verifies that Windows boot files exist and are correctly configured. - Compares the checksum for all Windows system files to make sure that they match what is on the installation media. Command Prompt: The Windows Recovery Environment provides a Command Prompt option that you can use to manually diagnose and repair system problems.\ \ Boot the system from the Windows installation disc or WinRE and repair the installation. Select **Troubleshoot** \> **Advanced Options** \> **Command Prompt**. You can use the Command Prompt option in the Recovery Environment to: - Read boot logs. - Discover the drives that Windows can see. - Enable and disable services. - Read and write data to the hard disk drive. - Overwrite corrupt or incorrect files (such as repairing a corrupt registry or restoring corrupt operating system files). - Format and partition drives. - Repair a corrupted master boot record. When using Command Prompt to troubleshoot problems, you should first research the problem using Microsoft Knowledge Base articles and print the exact instructions for performing recovery procedures.\ \ Command Prompt provides dozens of commands to display information and make changes. You can access a complete description of these commands and their syntax by typing **help** or **help / \[command\]** at the command prompt. Reset this PC (Also known as Fresh Start): Windows provides advanced recovery options for malfunctioning systems. Boot the computer into the recovery environment. Select Troubleshoot, then select **Reset This PC**.\ \ Microsoft uses the terms reset and refresh synonymously. You have two options for handling user data and apps when you select this option: - Keep my files reinstalls Windows but preserves user files. It also retains the apps that came with the PC and any apps you installed from the Windows Store. Traditional desktop applications are not preserved, but a.txt file named Removed Apps will be dropped on the desktop upon booting. - Remove everything reinstalls Windows without preserving user files, settings, or apps. You can select from the following options if you choose this option: - Just remove my files prepares the system for a new install of Windows. This is the fastest but least secure option. - Remove files and clean the drive obscures the data on the hard drive by overwriting it many times with random data. This option requires hours to complete, depending on the hard disk size. It is the best option to choose if the computer will be sold or recycled. System Recovery Disc/Partition: If you purchased the system from a major PC manufacturer, it might include a recovery partition on the hard drive. - You can use the recovery disc/partition to restore the system to the state it was in when shipped. - The recovery process typically restores a Windows image, which erases the hard drive. - Any applications, user settings, user preferences, and user data files added since the system was shipped will be lost. If possible, back up any data accessible on the hard disk before performing the recovery. - If the system has a recovery partition, the partition might not be visible from within the operating system. To use the recovery partition, edit the BIOS or boot using a special key combination as dictated by the manufacturer. Because the factory recovery option removes configuration settings and user data, it should be used only as a last resort and in combination with a good backup. Boot Configuration Data (BCD): The BCD store is a database that identifies possible operating systems and their locations on a disk. BCD enables administrators to assign rights for managing boot options. BCDEdit is a command line tool used to manage BCD stores. You can use BCDEdit to: - Manage BCD when the system boots from media other than the media on which the BCD store resides. For example, you might need to use BCDEdit to debug and troubleshoot a BCD store. - Edit boot options. To use BCDEdit, you must be a member of the local Administrators group. **Selecting a System Recovery Procedure** With so many options for system recovery, it could be difficult to determine which procedure to use. The following chart provides some recommendations for recovery procedure selection: Reverse a Windows Update: You can revert to the previous version of Windows when you have recently installed a Windows update, and the computer is not working well. Reset a PC: If you have not made any recent changes (drivers, updates, software installations, etc.), you can reset the computer. Restore from a system restore point: If you have not made any recent changes (drivers, updates, software installations, etc.), you can reset the computer. Restore previous version of Windows using Windows media: If the computer will not start up and you have not created a recovery drive, reinstall from Windows installation media. Restore previous version of Windows using recovery drive: If the computer will not start and you have created a recovery drive, you can use that drive to restore a previous version.